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1  Introduction 

Let  F2  be  the  prime  field  of  characteristic  2  and  let  IF"  be  the  n-dimensional  vector  space  over  F2.  A  function 
from  IF"  to  F2  is  called  a  Boolean  function  on  n  variables.  The  set  of  all  Boolean  functions  on  n  variables  is 
denoted  by®,,. 

Any  element  x  €  F"  can  be  written  as  an  n-tuple  (xi, . . . ,  xn),  where  x,-  e  F2  for  all  i  =  1, . . . ,  n.  We  let 
the  support  supp(x)  be  the  set  of  all  positions  i  where  x,-  =  1.  The  (Hamming)  weight  of  x  €  F"  is  denoted  by 
w//(x)  and  equals  £"=1  x,-  (the  Hamming  weight  of  a  function  is  the  weight  of  its  truth  table,  more  precisely  of 
its  output  vector,  that  is,  the  size  of  its  support,  see  below).  The  sets  of  integers,  real  numbers  and  complex 
numbers  are  denoted  by  Z,  IR  and  C,  respectively.  The  addition  over  all  these  sets,  as  well  as  on  F",  is  denoted 
byV.  We  denote  the  (vector)  complement  by  x  =  (xi  +  1, . . . ,  x„  +  1 ),  and  the  (Boolean  function)  complement 
by  /(x)  =  /(x)  +  1,  for  /  €  13  „.  If  we  define  the  union  as 

if  v  g)(x)  =  /(x)  +  g(x)  +  /(x)g(x) 

then  the  double  complement  operation,  /(x)  >->  fix),  has  the  following  properties: 

fix)  v  g(x)  =  fgix),  f  v  g(x)  =  /(x)g(x) 

(recall  that  fgix)  =  /(x)g(x)).  If  x  =  (xi, . . . ,  x„)  and  y  =  (yi, . . . ,  yn)  are  two  elements  of  F",  we  denote  the 
inner  product  and  the  intersection,  respectively,  by 


x  y  =  xiyi  +  x2y2  +  •  •  •  +  x„y„,  x  *  y  =  (xiyi,  x2y2, ....  x„yn). 
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We  define  the  union  x  v  y  to  be  the  vector  in  F"  whose  ith  component  is  0  if  and  only  if  x,-  =  y,-  =  0.  In  partic¬ 
ular,  supp(x  v  y)  =  supp(x)  u  supp(y).  For  u  =  (u i, ....  un),  v  =  (vi, . . . ,  vn)  e  F",  we  define  the  following 
partial  order  on  F": 

u  <  v  if  and  only  if  m  <  v,-  for  every  i. 

The  cardinality  of  the  set  S  is  denoted  by  |S|. 

For  a  detailed  study  of  Boolean  functions  we  refer  the  reader  to  Carlet  [2,  3]  and  Cusick  and  Stanica  [7]. 
For  the  reader’s  convenience,  we  recall  some  basic  notions  below. 

Any  /  €  23  „  can  be  expressed  in  algebraic  normal  form  (ANF)  as 

f(X  l,X2,  ...,X„)=  £  Ha(rK). 

a=(ai,...,an)€F2  i=l 

for  some  coefficients  pa  =  Pa(f)  €  F2.  Any  term  of  the  form  f["_i  xf 1  is  called  a  monomial.  The  ANF  of  any 
Boolean  function  satisfies  pa  =  Zx<a/(X)  anh /(x)  =  Za-<xFa- 

The  algebraic  degree  of/,  deg(/),  equals  maxacF» {w//(a)  |  pa  #  0}.  Boolean  functions  having  algebraic 
degree  at  most  1  are  affine  functions.  For  any  two  functions/,  g  €  23  „,  we  define  the  (Hamming)  distance 

d(f,g)  =  |{x  |/(x)  #g(x),  x  e  F2»}|. 

The  support  of  a  Boolean  function/  is  the  set  supp (/)  =  {x  |  /(x)  =  1}. 

The  (unnormalized)  Walsh-Hadamard  transform  of  /  €  23  „  at  any  point  u  e  F"  is  defined  by 

Wf( u)  =  £  (-l/(x)+ux.  (1.1) 

xeF" 

The  multiset  [Wf( u)  |  u  e  F"]  is  called  the  Walsh-Hadamard  spectrum  of  function /.  The  nonlinearity  of  /  is 
its  distance  from  the  set  An  of  all  n-variable  affine  functions,  that  is, 

nl  if)  =  min  d(f,g). 

gcA„ 

A  function/  e  23„  is  a  bent  function  if  the  Walsh-Hadamard  transform  (1.1)  has  constant  absolute  value  2n/2 
(which  is  possible  only  for  n  even).  It  is  well  known  that  /  €  23 „  is  bent  if  and  only  if  its  nonlinearity  achieves 
the  optimum  2"  1  -  2"^2  1.  Bent  functions1  hold  an  interest  among  researchers  in  this  area  since  they  have 
maximum  Hamming  distance  from  the  set  of  all  affine  Boolean  functions  and  have  very  nice  combinatorial 
properties,  used  in  many  domains  such  as  sequences,  cryptography  and  designs.  Several  classes  of  bent  func¬ 
tions  were  constructed  by  Rothaus  [16],  Dillon  [9],  Dobbertin  [10],  and  Carlet  [1].  If/ is  bent,  then  there  exists 
a  Boolean  function/ such  that  W/(u)  =  2",,2(-l/(u)  for  every  u  e  F".  This  function,  called  the  dual  off,  is  bent 
as  well  [9]. 

A  non-zero  vector  a  is  called  a  linear  structure  for  a  Boolean  function  /  if  the  derivative 

fla/(x)  =/(x)+/(x  +  a) 

(sum  calculated  in  F2)  is  constant  for  any  x.  It  is  known  [9, 16]  that  bent  functions  are  those  functions  whose 
derivatives  are  balanced,  and  so  bent  functions  do  not  have  any  non-zero  linear  structure. 

The  sum  C/,g(z)  =  XxeF'1  1S  the  crosscorrelation  of  /  and  g  at  z.  The  autocorrelation  of  /  e  23„ 

atu  €  F”  is  C/;/(u)above,  which  we  denote  by  e/(u).Themultiset[C/(u)  |  u  €  F"]  is  called  the  autocorrelation 
spectrum  of  the  function/. 

For  any  /  €  13 „,  a  non-zero  function  g  e  13 „  is  called  an  annihilator  off  if fg  is  null,  and  the  algebraic 
immunity  of  /,  denoted  by  A3(f),  is  the  minimum  value  of  d  such  that  /  or  /  +  1  admits  an  annihilator  of 


1  Bent  functions  were  first  studied  by  Rothaus  in  the  1960s,  although  his  paper  was  not  published  until  ten  years  later,  in  [16]. 
Their  first  appearance  was  in  a  preprint  of  Dillon  in  1972,  and  then,  with  more  details,  a  few  years  later  in  his  thesis  [9]. 
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degree  d  (see  [13]).  It  is  known  [5]  that  the  algebraic  immunity  of  an  n-variable  Boolean  function  is  bounded 
above  by  [|], 

A  Boolean  function/  is  monotone  (increasing)  if  whenever  u  <  v,  then/(u)  <  /(v).  It  is  easy  to  see  that  any 
monomial  Boolean  function  is  monotone.  Other  examples  are  the  strict  (resp.  large)  majority  functions  M  e  23„ 
(and  more  generally  the  functions  whose  supports  are  the  sets  of  vectors  of  Hamming  weights  bounded  by 
some  number  from  below).  The  value  of  M(x)  is  0  if  and  only  if  the  Hamming  weight  of  x  is  strictly  less  than 
n/2  (respectively,  it  is  smaller  than  or  equal  to  n/2). 

If  /  is  a  monotone  Boolean  function  (or  more  generally  any  Boolean  function),  we  define  the  least  (vector) 
support  set  T  =  If  c  supp(/)  c  F",  consisting  of  all  vectors  in  supp(/)  that  are  smallest  in  the  partial  order¬ 
ing  An  atomic  (monomial)  monotone  function  is  one  for  which  |T/|  =  1. 

Recall  that  Vi  v  v2  denotes  the  vector  with  component  0  if  and  only  if  both  the  components  of  Vi ,  v2  are  0 
in  that  position.  With  a  set  of  vectors  {v,-},-  fixed,  we  set 

Ei,i2...ik  =  {u  e  F"  [  u  *  =  0},  (1.2) 

where  we  use  the  notation 

k 

vUh...h  =  V  v‘i  =  V,i  V  V;2  V  •  •  •  V  V,v 
;=i 

Recall  the  Kronecker  delta  function  <5,s(u)  with  5s(u)  =  1  for  u  €  S,  and  5s(u)  =  0  otherwise.  If  S  =  {0}  we  will 
drop  the  subscript  S,  and  write  <5(u). 

For  v  €  IF",  we  use  the  usual  multi-index  notation  xv  for  the  product  of  variables,  with  indices  running 
through  the  non-zero  positions  of  v: 

xv=  n 

i'esupp(v) 

Monotone  Boolean  functions  are  important,  since  they  have  many  applications  in  voting  theory,  reliabil¬ 
ity  theory,  hypergraphs,  etc.  (cf.  Crama  and  Hammer  [6]).  So,  it  is  natural  to  inquire  about  their  cryptographic 
properties  as  well.  It  is  the  purpose  of  this  paper  to  look  at  some  of  the  main  cryptographic  properties  of  a 
Boolean  function,  namely,  (maximum)  nonlinearity,  balancedness  and  algebraic  immunity,  in  the  context  of 
monotone  Boolean  functions.  In  particular,  we  will  show  that  there  are  no  monotone  bent  functions,  using 
Walsh  transform  computations  (see  Section  4  below). 


2  Preliminaries 

We  survey  some  properties  of  a  monotone  Boolean  function  (we  shall  not  use  many  of  them,  but  they  are 
interesting,  nonetheless).  We  shall  follow  mostly  [4]. 

Recall  that  the  Hasse  diagram,  Pn,  is  the  directed  graph  whose  vertex  (node)  set  is  F",  and  edges  (v,  w) 
if  v  <  w  and  w//(w)  =  w//(v)  +1.  A  closure  C  c  G  of  a  directed  graph  G  =  (V}  E)  is  the  set  of  nodes  without 
any  outgoing  edges  (if  a  e  C  and  (a,  b)  e  E,  then  b  e  C).  It  was  shown  in  [4]  that  the  set  of  closures  in  Pn  is  in 
one-to-one  correspondence  with  the  set  of  monotone  functions  on  F". 

The  following  interesting  theorem  on  the  ANF  of  a  monotone  Boolean  function  was  proved  in  [4] ,  and  we 
shall  use  it  throughout  the  paper. 

Theorem  2.1  (Celerier  et  al.  [4]).  Let  f  be  a  monotone  function  whose  least  vector  support  set  is  T  c  F".  Then 

/(x) = i + nu +xv). 

veT 


In  terms  of  complements,  this  can  be  written 


/(x)  =  ]” [  xv. 

ver 
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Remark  2.2.  Given  any  Boolean  function /.the  function/' (x)  =  1  +  FIvesupp(/)(l  +  xv)  takes  value  1  at  x  if  and 
only  if  there  exists  v  €  supp(/)  such  that  v  <  x.  Hence,  /'  is  the  least  monotone  function  such  that  /  <  /'  (and 
/  is  monotone  if  and  only  if  /  =  /').  Let  T  be  its  least  vector  support  set,  then/'(x)  =  1  +  flvepd  +  xv)>  since 
v  <  w  =>  1  +  xv  <  1  +  xw  =>  (1  +  xv)(l  +  xw)  =  1  +  xv.  Note  that /  and/'  have  the  same  r  and  we  can  see  that 
if  we  apply  to  /'  the  same  transformation  again,  we  get  the  same  function  /' .  Note  also  that  if  v  €  r  then  xv 
necessarily  appears  in  the  ANF  off  (and/')  since  the  coefficient  of  xv  in  this  ANF  is  Yx<v  f(x)  =  /(v)  =  1- 

Let /be  a  monotone  Boolean  function  of  least  vector  support  set  T  =  {vp,  v2, . . . ,  vm}.  For  any  1  <  s  <  m,  we 
denote 

rili2...is  =  r\{vil,vi2,...,vis}. 

When  s  =  0,  by  convention,  we  set  T,^...,-,.  =  T.  Using  Theorem  2.1,  we  easily  deduce  the  following  corollary. 
Corollary  2.3.  Iff  is  monotone  with  least  vector  support  set  T  of  cardinality  m,  then 

/=  i  n  *v-  (2.o 

0  <s<m  verili2...ts 
1  <ii<—<is<n 

Remark  2.4.  It  might  be  tempting  to  conjecture  that  f|Vd  xV  appears  in  the  ANF  of  the  monotone  Boolean 
function/,  that  is,  that  all  variables  occurring  in  the  ANF  will  occur  in  a  single  highest  degree  term  of /.  This 
would  allow  simplifying  some  proofs  given  below.  However,  that  happens  to  be  false,  in  general,  since  there 
may  be  cancellations  in  equation  (2.1).  As  an  example  (see  [4,  Example  4.2]),  let  /  €  236  be  the  monotone 
function  with  least  support  set  T  =  {(1, 1, 1, 1, 0,  0),  (1, 1,  0, 0, 1, 1),  (0, 0, 1, 1, 1,  1)}.  The  ANF  of/ is  in  fact 
/(x)  =  X  [X2x3xtl  +  xiX2XsX(,  +  X3X4X5X6,  and  so,  all  variables  will  occur,  but  spread  out  in  several  monomials. 
A  similar  example,  also  monotone  but  in  5  variables,  is  g(x)  =  xoXiX2X4  +  X0X1X3X4  +  xox2x3X4. 

The  first  example  has  the  additional  property  that  W/(u)  +  0  for  all  u  €  F®.  However,  this  property  does 
not  hold  for  g  e  235 .  It  appears  that  n  =  6  is  the  smallest  dimension  for  which  there  exists  a  monotone  homo¬ 
geneous  function  having  non-zero  Walsh-Hadamard  spectrum,  that  is,  Wf(u)  +  0  for  all  u  €  F®. 

Remark  2.5.  If  deg (f)  <  n  and  there  does  not  exist  Ti  c  T  such  that 

(J{*i  |  i  e  supp(v)}  =  |J  {x*  |  i  e  supp(w)}, 

veT  weTi 

then  the  ANF  of  /  lacks  a  variable.  This  implies  that  there  is  a  variable,  say  x;,  that  /  does  not  depend  on. 
Thus,  /  has  a  linear  structure,  since /(x)  +/(x  +  e,)  =  0,  for  all  x  €  F2,  where  e,-  is  the  standard  basis  vector 
with  1  in  the  ith  position  and  0  elsewhere. 


3  Constructions  of  monotone  functions 

We  note  that  / :  F"  — >  F2  is  monotone  if  and  only  if  the  subfunctions  fj(x  1, . . . , x„  /)  =  /(j,  xi, . . . ,  xn  l) 
O'  =  0, 1)  are  monotone  and  satisfy  supp (f0)  Q  supp(/i). 

Three  elementary  examples  of  secondary  constructions  of  monotone  functions  (building  a  monotone 
function  from  monotone  functions  gi, . . .)  are  the  “double  complement”  operation 

g  g(x)  =  g(Xi  +  1,  .  .  .  ,  xn  +  1)  +  1 

and  the  operations  gi  •  g2  =  gig2  and  gi  v  g2  =  gi  +  g2  +  gig2 .  Note  that  the  “double  complement”  operation 
is  involutive  (hence,  g  €  23„  is  monotone  if  and  only  if  g(x)  is  monotone)  and  exchanges  gi  •  g2  and  gi  v  g2 . 
It  is  easy  to  construct  monotone  functions  using  the  monomials  and  the  operations  of  and  “v”. 
According  to  Theorem  2.1,  constructing  a  monotone  function  is  straightforward:  we  choose  a  set  T  of 
vectors  which  are  non-comparable  with  respect  to  ^  and  we  define  /(x)  =  1  +  liver +  xV)  (note  that  if  T 
includes  vectors  which  are  comparable,  then  this  gives  also  a  monotone  function,  but  the  set  of  minimal 
elements  in  supp(/)  is  not  equal  to  T). 


Authenticated  |  wdj@usna.edu  author's  cop; 
Download  Date  |  1/9/16  4:02  AM 


DE  GRUYTER 


C.  Carlet  et  al.,  Cryptographic  properties  of  monotone  Boolean  functions 


5 


The  secondary  constructions  and  “v”  are  particular  cases  of  a  much  more  general  secondary  con¬ 
struction,  which  is  easy  to  show  and  certainly  known  (see,  for  example,  [11]). 

Theorem  3.1.  Let 

•  f  €  Bn  be  monotone,  and 

•  g\, . . . ,  gn  be  n  monotone  functions  (in  distinct  variables  or  not). 

Then,  denoting  g  =  (gi, ...  ,gn),  the  vectorial  composition  f  °  g  (viewed  as  a  function  in  the  union  of  the  vari¬ 
ables  of  g\ , ....  gn)  is  a  monotone  function. 

Proof.  When  any  of  the  variables  of  gi, . . . ,  gn  move  from  value  0  to  1,  while  the  others  remain  constant, 
each  value  of  g\, . . . ,  gn  does  not  decrease  since  gi, ...  ,gn  are  monotone,  and  then  the  value  off  °  g  does 
not  decrease  either,  since  /  is  monotone.  □ 

Note  that  this  result  is  very  general.  The  knowledge  of  any  monotone  function  in  n  variables  and  of  any  set  of  n 
monotone  functions  gives  a  monotone  function  in  a  number  of  variables  which  can  be  larger  or  smaller  than  n. 
So  we  have  here  a  secondary  construction  of  a  nature  quite  different  from  common  secondary  constructions 
of  cryptographic  Boolean  functions  (where  the  numbers  of  variables  most  often  increase  or  at  least  do  not 
decrease),  see,  e.g.,  [2]. 

Note  also  that  the  secondary  construction  is  obtained  from  Theorem  3.1  by  taking  /(xi ,  x2)  =  X\X2 
and  the  secondary  construction  v  is  obtained  by  taking  /(x i,x2)  =  X\X2  +  xt  +  x2  +  1  (these  two  functions 
are  the  strict  and  large  majority  functions). 

We  give  now  examples  of  specifications  of  the  construction  of  Theorem  3 . 1 .  By  taking  in  Theorem  3 . 1  the 
gi  equal  to  monomials  in  distinct  variables  and  of  the  same  degree  and  /  equal  to  any  monotone  function,  we 
obtain  a  construction  which  will  be  useful  below: 

Corollary  3.2.  Iff  is  monotone,  then  the  function  obtained  by  replacing  any  monomial  xv  by  xvyvzv . . .  (that 
is,  replacing  each  Xj  by  xiyiZi . . .)  in  the  ANF  off  is  monotone  as  well. 

By  taking  the  function /(x)  to  be  the  m-variable  (monotone)  function  1  +  5(x)  =  1  +  f[ 1  (1  +  x()  and  all  func¬ 
tions  gi  to  be  monomials,  we  have: 

Corollary  3.3  (Construction  MBF).  Lef/;(x)  =  1  +  Ilver^l  +  xV)  be  monotone  Boolean  functions  in  Bn  of  least 
support  sets  T,-  =  (v,-;-);.  Let  m  =  max;|T;|  and  let,  for  each  j,  TJ  denote  the  multi-set  obtained  from  Tj  padded 
with  enough  copies  of  the  zero  vector  0  so  that  |T*  \  =  m.We  define  f  in  CB*  „  by 


Observe  that  /  has  least  support  set  f  =  {(vq, . . . ,  Vkj)j=i,...,m}- 

We  could  certainly  take  all  /;  (1  <  i  <  k)  to  be  equal  to  a  monotone  function  /  (depending  on  independent 
sets  of  variables),  of  least  support  set  T  =  {vi, . . .  ,vm},  and  we  can  use  any  order  on  the  k  copies  of  T.  We  set 


f  =  r(,T)  =  {(vCTl(f),  va2(i), ...,  vat(i))  |  i  =  1,  2, . . . ,  m}, 


where  n,  are  permutations  on  {1,  2 , ...  ,m}.  Then 


is  a  monotone  Boolean  function. 

Example  3.4.  Let 

/i(*i>*2> *3)  =  1  +  (1  +xix2)(l  +xix3)(l  +  x2x3)  =  xix2  +X1X3  +X2X3  and  /2(x4)  =  x4 
be  monotone  functions  in  23  3  and  231,  respectively,  with  least  vector  support  set 


Ti  =  {(1,  1,0),  (1,  0, 1),  (0, 1, 1)}  and  T2  =  {(1)}  (padded  to  T'2  =  {(1),  (0),  (0)}), 
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respectively.  Then 

f(X i,  X2,X3,Xtt)  =  1  +  (1  +  X3X2X^)(1  +  XiX3)(l  +  X2X3)  =  X3X3  +  X2X3  +  X3X2X3  +  XiX2X/f  +  XiX2X3Xti 

is  also  monotone  of  least  vector  support  set  f  =  {(1, 1,  0, 1),  (1,  0, 1, 0),  (0, 1, 1,  0)}. 


4  Some  (non)existence  results  on  monotone  Boolean  functions 


4.1  Bent  monotone  functions 


Celerier  et  al.  [4]  proposed  a  conjecture,  which  is  proved  next. 


Theorem  4.1.  For  every  even  n  >  4,  there  exists  no  n-variable  monotone  bent  function. 


Proof.  The  idea  behind  the  proof  is  to  connect  a  potential  monotone  bent  Boolean  function  to  the  majority 
function,  which  is  known  not  to  be  bent,  if  n  >  4,  thus  obtaining  a  contradiction. 

For  every  /  monotone,  every  y  g  supp  (/)  and  every  a  €  IF ",  we  have 


£(-l/w+a'x  =  ^(_i)ax 
x<y  x<y 


f2w«(y>  ifa^y, 

0  otherwise. 


where  y  is  the  bitwise  complement  of  y.  Indeed,  the  set  {x  e  F"  |  x  <  y}  is  a  vector  space  and  its  dual  is 
{a  €  F"  I  a  <  y}.  We  know,  according  to  the  Poisson  summation  formula  (see  [1,  Lemma  1],  [2,  p.  275];  see 
also  [7,  p.  8]  and  [12,  Chapter  5,  Lemma  2],  for  some  particular  cases)  that 


£(— Ij/W+a-x  =  2w„(y)-«  £  Wf(  u). 

X^y  a+u^y 

If  /  is  bent,  we  have  then 

V  (-!)/(“>  =  |2"/2  lfa^’ 

a  m-<y  |°  otherwise. 

This  implies  that  y  has  weight  at  least  n/ 2  (i.e.y  has  weight  at  most  n/2)  for  every  y  g  supp (/).  Moreover, 
if  y  g  supp (/)  has  weight  n/2  then /  is  identically  null  on  [u  e  F"  |  u  <  y}. 

For  every  y  €  supp (/)  and  every  a  e  F",  we  have 


I 


(_l)/(x)+ax 


xeF",y<x 


£  (-Di+ax=  ^(-Di+ax 
xeF"  x<y 


I(_l)i+WH(a)  2«-WH(y)  ifa^y, 

0  otherwise. 


The  set  {x  €  F"  I  y  ^  x}  equals  (1, . . . ,  1)  +  {x  e  F"  |  x  <  y}  and  {x  e  F"  |  x  <  y}  is  a  vector  space  whose  dual 
equals  {x  €  F"  I  x  ^  y}-  According  to  the  Poisson  summation  formula,  we  have  then 


£  (_X)/(x)+ax 

xeFj.yix 


2-w«(y)(_i)w«(a)  £  (-i)Wh(u) W/(u) 
a+u<y 


_  2«/2-w//(y)  ^  (_i)W//(a)+wH(u)+/(u) 

a+u<y 


Thus 


X  (-D 


l+wH(u)+/(u) 


a+u^y 


2n/1  ifa<y, 

0  otherwise. 


This  implies  that  y  has  weight  at  least  n/ 2  for  every  y  e  supp (/).  Moreover,  if  y  €  supp (/)  has  weight  n/2 
then  1  +  wh(u)  (mod  2)  +  /(u)  is  identically  null  on  {u  €  F"  I  u  <  y}. 
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Summarizing,  we  have: 

(i)  if  wH(y)  <  n/2,  then/(y)  =  0  and  Iuiy(-l/(u)  =  2n/2; 

(ii)  if  Wfl(y)  >  n/2,  then /( y)  =  1  and  ZUiy(_l)1+WH(u)+^(u)  =  2”/2; 

(iii)  if  wh(y)  =  n/2,  when  /(y)  =  0,  then  /  is  identically  null  on  {u  e  F"  j  u  x  y(  and,  when  /( y)  =  1,  then 
1  +  wh(u)  (mod  2)  +  /( u)  is  identically  null  on  [u  €  F"  |  u  <  y}. 

Condition  (iii)  implies  that  an  element  y  of  Hamming  weight  n/  2  in  the  support  of  /  and  an  element  y '  of 
Hamming  weight  n/2  whose  complement  is  outside  the  support  off  are  necessarily  such  that  the  set 

{u  e  F"  I  u  <  y  andu  r<  y'} 

contains  no  element  of  even  Hamming  weight,  which  is  impossible  since  this  set  contains  the  zero  vector. 
This  means  that  either  all  elements  of  Hamming  weight  n/2  are  in  the  support  of  /  or  all  are  outside.  In  both 
cases,  we  arrive  at  a  contradiction  since  the  majority  function  is  not  bent  for  n  >  4.  □ 

Remark  4.2.  For  n  =  2,  two  monotone  bent  functions  exist,  namely,  the  strict  and  large  majority  functions, 
whose  supports  are  the  sets  {(1, 1)}  and  {(0, 1),  (1,  0),  (1, 1)}  (recall  that  a  function  in  two  variables  is  bent  if 
and  only  if  it  has  odd  Hamming  weight). 


4.2  Homogeneous  monotone  functions 

A  Boolean  function  is  called  homogeneous  if  all  the  monomials  in  its  ANF  have  the  same  degree. 

Monotone  homogeneous  functions  exist  (the  simplest  ones  are  the  monomials;  the  simplest  polynomial 
one,  in  three  variables,  is  XiX2  +  XiX3  +  x2x3). 

Theorem  3 . 1  can  be  specified  to  give  a  secondary  construction  of  homogeneous  monotone  functions,  but 
the  hypothesis  is  then  rather  restrictive: 

•  If  /  e  23  „  is  monotone  homogeneous,  and 

•  gi, ...  ,gn  e  23  m  are  n  monotone  homogeneous  functions,  each  of  distinct  variables,  which  all  have  the 
same  degree, 

then  the  vectorial  composition/  »ge  23mn  is  monotone  homogeneous,  where  g  =  (gi, . . . ,  gn)- 

Corollary  3.2  also  gives  a  secondary  construction  of  homogeneous  monotone  functions,  but  a  rather 
straightforward  one: 

If  /  is  homogeneous  monotone,  then  the  function  obtained  by  replacing  any  monomial  xv  by  xvyvzv  . . . 
(that  is,  replacing  each  x,-  by  Xjy;Z; . . .)  in  the  ANF  of  /  is  homogeneous  monotone  as  well.  This  is  generalized 
below  in  Theorem  4.5  (B). 

Homogeneous  monotone  functions  have  the  following  nice  property. 

Lemma  4.3.  Let 

/(x)  =  X  xv 

veA 

be  a  homogeneous  function,  where  all  the  elements  in  A  have  Hamming  weight  d.  Assume  thatf  is  monotone. 
Then  the  least  vector  support  T  off  equals  A. 

Proof.  For  any  v  e  A ,  we  have  /(v)  =  1 ,  since  vv  =  1  and  vv  =  0  for  every  other  v'  in  A ,  because  some  index  i 
exists  in  the  support  of  v'  such  that  the  corresponding  coordinate  of  v  is  null.  And  for  every  v'  in  IF”  such  that 
v'  -<  v  we  have /(v')  =  0.  Thus,  v  e  T.  Let  now  v  i  A  be  given  with /(v)  =  1.  It  follows  that  |supp(v)|  >  d,  since 
otherwise,  for  every  v'  €  A,  some  index  i  exists  in  the  support  of  v'  such  that  the  corresponding  coordinate 
of  v  is  null.  Furthermore,  there  exists  Vo  with  Vo  <  v,  such  that  supp(v0)  e  A,  and  so  v  is  not  a  least  vector  in 
the  support  of/.  □ 

The  following  lemma  (whose  proof  is  rather  straightforward)  proves  to  be  quite  useful. 

Lemma  4.4.  A  homogeneous  function  £vcr  xv  is  monotone  if  and  only  if  for  each  x  €  IF", /or  which  there  exists 
v  e  T  such  that  v  <  x,  the  number  of  such  v  is  odd. 
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We  next  make  some  observations,  find  a  construction  for  homogeneous  monotone  functions  based  upon 
Corollary  3.3  (Construction  MBF),  and  we  further  prove  a  nonexistence  result,  under  some  restrictive 
conditions. 

Theorem  4.5.  (A)  Iff  is  a  homogeneous  monotone  Boolean  function,  then: 

(i)  m  =  |T|  is  odd. 

(ii)  We  have  1  +  Ilvert1  +  xv)  =  Iver  xv> over  F2. 

(iii)  For  every  non-zero  u  e  IF", 

m 

£(2fc(_i)m-fc  +  2(-l)fc)|{(i1,  ...,ik)c  rn}\  vh..Jk  =  u}|  =  0. 

k=  1 

(B)  (Construction  HMBF)  If  fi(x)  =  Xvcr  xV  for  i  =  are  monotone  homogeneous  functions  with 

T;  =  and  |r,  |  =  m,  then  the  function 

m  k 

/(X 1, . . . ,  Xfc)  =  £  Y\  XT’  X1,  •  ■  • .  xJt  e  IF" 

i=i  j=i 

is  also  monotone  homogeneous  in  23  kn  of  least  vector  support  f  =  {(v^, ....  v;<7);=1 . m}. 

Proof.  The  claims  (i)  and  (ii)  of  (A)  follow  easily  from  the  above  lemmas  and / or  Theorem  2.1.  Regarding  claim 
(iii),  we  observe  that  the  identity  £V6r(l  +  xv)  =  f[Verd  +  xV)  can  be  transformed  into  an  equality  over  the 
ring  of  integers  by  using  (-  ljTvrrO  lx')  =  /[vrr(2xv  -  1)  =  1  -  2  Ilver^  _  xv).  Expanding  and  identifying  the 
coefficients,  we  obtain  the  claim  (iii). 

Next,  we  show  our  construction  for  homogeneous  monotone  Boolean  functions,  that  is,  claim  (B).  It  is 
easy  to  see  that/  is  homogeneous,  since,  for;  fixed,  xj’<  has  the  same  degree  for  every  i,  and  so,  f[/Li  xj"  will 
have  the  same  degree  for  every  i. 

To  show  that  /  is  monotone,  we  use  Lemma  4.4.  Let  (xi,  x2, . . . ,  x/c)  be  an  arbitrary  vector  and  assume 
that  there  exists  (vi,  V2, ....  v/()  <  (xi,  X2, . . . ,  x;().  By  absurd,  we  assume  that  there  are  an  even  number  of 
such  (vi,  v2, . . . ,  V;().  Since  Vi  <  xi,  v2  <  x2,  etc.,  it  follows  that  there  is  an  index  1  <  i  <  k  such  that  there 
are  an  even  number  of  v  with  v  ^  x,-,  which  is  a  contradiction.  □ 

As  in  Corollary  3.3  (Construction  MBF),  as  a  particular  case,  we  can  take  all  /■  (1  <  i  <  k)  to  be  equal  to  a 
monotone  function  /  (depending  on  independent  sets  of  variables),  of  permuted  least  vector  support  T,  then 
/(x i , . . . ,  Xk)  =  £f=]  UU  x]a'{i)  >s  a  monotone  and  homogeneous  Boolean  function.  Further  instantiating,  by 
taking  every  permutation  to  be  the  identity,  if/(x)  =  £ver  xv  is  a  monotone  homogeneous  function,  then  the 
function /(x,  y,  z, . . .)  =  £V£r  x:vyvzv  ...  is  also  monotone  homogeneous  as  we  already  observed. 

Note  that  Remark  2.4  can  be  obtained  by  the  construction  of  Theorem  4.5  (B),  via  an  appropriate  relabel¬ 
ing,  namely  (xi,  x2,  x3,  x4,  x5,  xg)  <->  (xi,  yi,  x2,  y2,  x3 ,  y3).  That  is,  if  we  take  the  homogeneous  monotone 
function 

/(x)  =  X3X2  +  X3X3  +  X2X3 

with  T  =  {(1, 1, 0),  (1,  0,  1),  (0, 1, 1)},  the  homogeneous  monotone  function  of  Remark  2.4  is/(x,  y),  whose 
least  vector  support  is  f  =  {(1, 1,  0, 1, 1,  0),  (1,  0, 1, 1, 0, 1),  (0, 1, 1,  0, 1, 1)}. 

We  are  not  aware  of  any  other  general  construction  for  homogeneous  monotone  Boolean  functions.  It 
seems  difficult  to  determine  all  homogeneous  monotone  functions  and  we  leave  this  as  an  open  problem. 


5  On  the  nonlinearity  of  monotone  functions 

Let  /  be  any  n-variable  monotone  Boolean  function.  For  every  y  e  IF"  such  that/(y)  =  0,  we  have  (according 
to  the  Poisson  summation  formula  and  similarly  to  what  is  done  in  Section  4  above  for  bent  functions) 

£  Wf(  u)  =  2"-w«(y)  £  (-l/W  =  2n. 

ueFj;  u-<y  xe  F";x<y 
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This  implies  that  maxueF«. uiy |  W/(u) |  >  2Wl,(y> .  For  every  y  €  IF"  such  that  /( y)  =  1 ,  we  have,  by  applying  the 
Poisson  summation  formula  to  the  function /(x),  whose  Walsh  transform  equals  (-l)(1,"  ’1)  u  W/(u): 

£  (_1)(l,...,l)-uM/y(u)  =  2w„(  y)  £  (-1)/®  =  2Wif(y)  £  (-l)/(x)  =  -2". 

u€Ej;uiy  X6F";xiy  xeEjiyix 

This  implies  that  maxU£F»;uiy|W/(u)|  >  2"~w«(y). 

If  /(x)  differs  from  the  majority  function  for  at  least  one  input  x  of  Hamming  weight  different  from  n/ 2 , 
then  there  exists  y  either  of  Hamming  weight  larger  than  n/2  and  such  that/(y)  =  0  or  of  Hamming  weight 
smaller  than  n/2  and  such  that/(y)  =  1.  In  both  cases  we  have  maxuf[:j |  W/(u)|  >  2n/1+1  if  n  is  even  and 
maxU€]F»|W/(u)|  >  2(n+1)/2  if  n  is  odd,  and  then 

f  2"-1  -  2n/2  if  n  is  even, 
nl  (f)<  \ 

1 2"  1  -  2(n  1)/2  if  n  is  odd. 

If  /(x)  does  not  differ  from  the  majority  function  for  at  least  one  input  x  of  Hamming  weight  differ¬ 
ent  from  n/ 2,  then,  if  n  is  odd  then  /  is  the  majority  function  and  we  know  that  this  same  inequality 
nUJ)  <  2"_1  -  2(n~1)/2  is  true  for  n  >  5  since  the  nonlinearity  equals  2"_1  -  ((nn  deduce: 

Theorem  5.1.  Let  n  >  5  be  odd  andf  e  be  monotone.  Then  nl(/)  <  2"_1  -  2(n~1)/2. 

We  conjecture  that,  if  n  is  even  and  sufficiently  large,  then 

nl(/)  <  2n-1  -  2n/2. 

Observe  that  this  conjecture,  if  true,  provides  an  alternative  proof  of  our  main  result,  at  least  for  large  n. 


6  Algebraic  immunity  of  monotone  Boolean  functions 

We  next  are  concerned  with  the  algebraic  immunity  of  monotone  functions. 

Theorem  6.1.  The  algebraic  immunity  of  a  monotone  Boolean  function  f  is 

A3(J)  <  min{[n/2],  minfw/dv)},  minjn  -  wH(v)}},  (6.1) 

ver  V£f 

where  y  is  constituted  by  all  vectors  in  IF"  \  supp(/)  that  are  greatest  in  the  partial  ordering  <. 

Proof  Firstly,  we  simply  observe  that 

(/  +  1)  xw  =  xw  ]~~[(1  +  xv)  =  0, 
ver 

foranyw  e  T,  and  so  a  minimal  annihilator  of/  +  1  is  given  by  xv°,  where  Vo  has  minimal  weight  (not  unique, 
in  general).  Using  [5],  we  have 

A3(f)  <  min{[n/2],  min{w//(v)}}. 

ver 

Further,  note  that  for  any  w  e  y  we  have 

/(x)  xw  =  fix)  ]^[  (1  +  xt)  =  0, 

z'esupp(w) 

since  xw  =  1  if  and  only  if  w'  <wr  and  since /(w')  =  0  for  any  w'  <  w.  Thus,  we  have 

A3(J)  <  min{n  -  wH{ w)}, 

WGf 

thanks  to  deg(xw)  =  |supp(w)|. 

From  what  has  been  discussed  above,  we  immediately  get  our  assertion.  □ 
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Inequality  (6. 1)  is  certainly  attained  (take  as  an  example  the  majority  function,  for  even  n),  but  in  general,  it 
is  strict.  For  instance,  if  we  take  n  =  6  and  the  least  support  T  =  {v  =  (1, 1, 1,  0,  0,  0),  w  =  (0, 0, 0, 1, 1, 1)}, 
then  the  monotone  function 


/(X)  =  1  +  (1  +  XV)(1  +  XW)  =  1  +  (1  +  X1X2X3XI  +  *4*5*6)  =  *1*2*3  +  *4*5*6  +  *1*2*3  *4*5*6 

has  algebraic  immunity  2,  as  one  can  easily  check,  and  minV£r{wH(v)}  =  3. 

We  can  certainly  give  a  sufficient  criterion  for  a  more  precise  result  (albeit,  a  weak  result  from  a  cryptographic 
viewpoint). 

Proposition  6.2.  Let  f  be  a  monotone  Boolean  function  whose  least  vector  support  is  T  =  {vi, ....  vg}.  If 
fiver  supp(v)  #  0»  then  the  algebraic  immunity  off  is  AJ(f)  =  1. 

Proof.  Write  /(x)  =  Ywca  xW>  f°r  some  set  of  vectors  A .  Since  fvcr  supp(v)  +  0,  there  exists  i0  e  fvcr  supp(v), 
and  so,  i 0  e  fwc/1  supp(w)  as  well.  Thus 

/(x)  ■(!+*,•„)=  X  xW+  I  xW  =  °. 

wreA  wgA 

which  shows  that  AJ(J)  =  1  (since  it  is  obvious  from  our  condition  that  /  is  not  constant).  □ 

Example  6.3.  Let  n  =  5  andr  =  {v  =  (1, 0, 1, 1,  0),  w  =  (0, 1,  0, 1, 1)}.  Then  the  monotone  Boolean  function 
/(X)  =  !  +  (!+  XV)(1  +  XW)  =  1  +  (1  +  XiX3Xa)(1  +  *2*4*5)  =  *1*3*4  +  *2*4*5  +  *i*2*3*4*5 


has  A3(f)  =  1,  since  1  +  is  an  annihilator  of/. 


From  a  cryptographic  viewpoint,  we  are  interested  in  those  monotone  functions  which  have  maximum  al¬ 
gebraic  immunity.  For  an  odd  number  of  variables  n,  Qu,  Li  and  Feng  proved  in  [15]  that  there  are  exact 
two  n-variable  symmetric  Boolean  functions  with  maximum  algebraic  immunity,  the  majority  function  and 
its  complement.  For  an  even  number  of  variables  n,  Peng,  Wu  and  Kan  [14]  determined  all  the  symmetric 
Boolean  functions  with  maximum  algebraic  immunity;  the  total  number  of  such  symmetric  Boolean  func¬ 
tions  is  (2w#(n)  +  l)2Llog2  "J,  where  w//(n)  is  the  Hamming  weight  of  the  binary  expansion  of  n.  It  would  be 
interesting  to  determine  the  exact  number  of  monotone  functions  with  maximum  algebraic  immunity,  and 
we  shall  do  that  next. 

First,  for  any  even  n  >  4,  we  define  a  function/  e  T>„  as 


/(x)  = 


0, 

hx 

1, 


ifwj/(x)  <  ", 
ifw/Xx)  =  f , 
ifwj/(x)  >  ", 


(6.2) 


where  bx  can  be  taken  arbitrarily  in  IF2-  Let  us  denote  by  H'n  the  set  of  all  Boolean  functions  given  by  (6.2). 
It  has  been  proved  in  [8]  that  every  function  in  H'n  has  maximum  algebraic  immunity.  We  can  easily  see  that 
every  function  in  T>'n  is  monotone. 


Theorem  6.4.  For  every  odd  n,  the  majority  function  ofn  variables  is  the  unique  monotone  function  with  maxi¬ 
mum  algebraic  immunity.  For  every  even  n>  4,  a  monotone  function  f  e  'Bn  has  maximum  algebraic  immunity  if 
and  only  iff  e  H'n.  The  number  of  such  monotone  Boolean  functions  on  even  n  >  4  number  of  variables  is 
among  which  there  are 

(  \ 

'  1  (n/2) ' 

balanced  ones. 


Proof.  It  is  well  known  that  if  a  function  in  odd  number  of  variables  has  maximum  algebraic  immunity  then 
it  is  balanced.  By  Theorem  6. 1,  we  directly  get  our  first  claim,  since  T  can  then  only  contain  vectors  of  weights 
larger  than  or  equal  to  [n/2]  and,  the  function  being  balanced,  T  must  then  equal  the  set  of  all  vectors  of  such 
weight. 
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To  show  the  second  claim,  recall  that  every  function  in  33  J,  has  maximum  algebraic  immunity.  Thus  if 
/  €  33„,  we  have  that  /  has  maximum  algebraic  immunity.  We  now  prove  that  if  /  has  maximum  algebraic 
immunity  then/  €  33],.  According  to  Theorem  6.1,  if  /  has  maximum  algebraic  immunity  n/ 2,  then  any  ele¬ 
ment  of  the  least  support  set  of  /  has  Hamming  weight  no  less  than  n/2  and  every  element  in  p  has  Hamming 
weight  strictly  less  than  n/2  +  1.  This  implies  that  /  e  33  J,.  Certainly,  the  count  follows  easily  from  (6.2),  and 
so,  for  every  even  n  >  4,  there  are  exactly  2  monotone  functions  with  maximum  algebraic  immunity,  and, 
among  these  there  are  exact 

( L%)  \ 

VlinW 

balanced  such  functions.  □ 


7  Walsh  spectrum  of  monotone  Boolean  functions 


Recall  the  notation  for  the  subspace  Ep of  vectors  “disjoint”  from  \/j=i  v(  in  (1-2). 

For  any  subspace  E  c  IF",  let  E1-  denote  the  algebraic  dual  space  of  E.  The  following  useful  fact  will  not 
be  proven  here. 

Lemma  7.1  (“character-sum  property”  [1]).  IfE  is  any  ¥2-subspace  o/F"  and  a,  b  e  F"  th en 


I  (-Dax 

xeb+E 


J|F|(-l)ab,  a  €E\ 

|o,  a  iE-1-. 


We  next  look  at  the  Walsh-Hadamard  spectrum  of  a  monotone  Boolean  function /(x)  =  1  +  f|Vci^  1  +  xv)- 

Theorem  7.2.  Letf  be  a  nonconstant  monotone  Boolean  function  with  least  vector  support  T. 

(i)  If\T\  =  1  (i.e.,  f  is  atomic),  say  Y  =  {v},  then  the  Walsh-Hadamard  spectrum  off  is 

[  2n  _  2n+l-wH(v)  ^  u  =  0, 

Wf(  u)  =  \ 

2«+1^m,h(v)(_i)1+u  v  foru  #  0. 


Consequently,  the  nonlinearity  is  nl (/)  =  0  ifwjjfv)  =  1,  or  nl(/)  =  2"  Wh(v)  ifwuty)  >  1. 

(ii)  If\T\  =  2,  say  T  =  {vi ,  v2},  then  the  Walsh-Hadamard  spectrum  off  is 


Wf(  u) 


2n  —  2n+i-wtf(vi)  —  2n+1-w#(v2)  +  2n+1_w^(vivv2) 
2„+i-w„(v1)(_1)1+uv,(5£,,  (U)  +  2n+l-wH(v2)(_1)l+u-v2^(u) 


_  2n+1-M'H(VlVV2)(_1)l+U(ViVV2)^^  (y) 

(iii)  In  general,  the  Walsh  spectrum  for  a  monotone  f  with  T  =  {vi, . . . ,  vg }  is 


for  u  =  0, 
for  u  +  0. 


Wf(u) 


2n  -  2n+1  Xf=1(_l),c  1  Z 


l<ii<-<ik<g 


2-WH(ViU2...ik) 


)H  + 1  X'g 


ik(u) 


for  u  =  0, 
for  u  #  0. 


Proof.  First,  observe  that  the  Walsh-Hadamard  transform  of  /  is 


Wf( u)  =  2"<5(u)  -  2  ^  /(x)(-l)ux  =  2"6(u)  -  2  ^  (-!)u'x 

X€Fj  X€SUpp(/) 

=  2"fi(u)  -  2  Y  (-l)ux. 

for  some  veT 


Assume  first  that  T  =  {v}  (v  y  0,  since  /  is  nonconstant).  We  want  to  point  out  that  variations  of  this  first 
“atomic”  case  are  known  (see,  for  instance,  MacWilliams  and  Sloane  [12,  Chapters  13-15]),  but  we  include 
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the  complete  argument  here,  as  it  will  provide  some  insight  into  the  general  case.  If  w/;(v)  =  l,then/(x)  =  xv 
(=  Xj,  where  v,-  y  0)  is  certainly  linear  and  the  claim  regarding  the  nonlinearity  follows  immediately,  so  we 
assume  that  wjj(v)  >  2.  Then, 


Wf(0)  =  2n-2  £  1  =  2"-  2|{x  €  F"  |  v  :<  x}|  =  2"  -  2n+1-WH(v). 

X£Fj,ViX 


Next,  observe  that 

E  =  {u  €  F"  |  u  *  v  =  0}  =  {u  €  F"  I  supp(u)  n  supp(v)  =  0} 

is  a  subspace  of  IF"  of  cardinality  |£|  =  2"  w"(v\  and  {x  €  F"  |  v  <  x  for  some  veT)=v  +  £.  Thus,  for  u  t  0, 
using,  as  before,  the  character-sum  property  (Lemma  7.1),  we  get 


Wf(u)  =  -2  £  (—  l)u x  =  -2  £  (-l)ux 

xeF",vix  xev+E 

| |£|(-l)uv  if  u  e  E-1,  _  1 2n+1_WH(v)(-l)1+u'v  if  u  €  fr1, 

0  otherwise  0  otherwise. 

If  w//(u)  >  1,  then  the  nonlinearity  is 

nl(/)  =  2"-1-imax|M7/(u)| 

1 

_  2n~ 1  -  —  max{2n  -  2n+1~WH^\  2n+1~WH W} 

i 

_  —  2n+1_w^(v))  —  2n~wn(v') 

We  next  consider  the  case  of  |T|  =  2,  say  T  =  {vi,  v2}.  As  before, 

Wf( 0)  =  2"  -  2  £  1 

xeF^.v^x 
for  some  veT 

=  2"  -  2([{x  €  F"  |  Vi  ^  x}|  +  |{x  €  F"  |  v2  <  x}|  -  |{x  e  F"  |  vx  V  v2  <  x}|) 
—  2n  —  2n+1_wtf(Vl)  —  2n+1~WH^  +  2n+1_Wi/^VlVV2^ 


Let  Ei  =  {u  e  F"  I  u  *  v,-  =  0}  for  i  =  1,2,  and£i2  =  {u  €  F"  |  u  *  (vi  v  v2)  =  0}.  Then2  we  have, 

Wf(  u)  =  -2  £  (-l)ux 

xeF^v^x 
for  some  veT 

=  -2(  X  (-Dux+  I  (-Dux-  I  (-Dux) 

xevi+Ei  xev2+£,2  xeviW2+£'i2 

=  -2|E1|(-l)UVl5£,(u)  +  |£2|(-l)UV2<5£,(u)  -  |^2|(-l)u(VlVV2><5£i-2(u) 

=  2"+1”w«(Vl)(-l)1+UVld£i-(u)  +  2"+1“Wh(V2)(-1)1+UV2<5£^(u) 

_  2n+l-M'H(VlVV2)^_^^l+U(ViVV2)^£± 

Certainly,  the  method  can  be  extended  to  arbitrary  T  =  {vi, . . . ,  vm},  using  the  inclusion-exclusion  principle. 
Recall  that  vili2...it  =  V;ti  V;.,  and 

Ehh...ik  =  {u  e  F"  |  u  *  Vili2...ik  =  0}. 

With  these  notations,  we  obtain 

m 

Wf( 0)  =  2"  -  2"+1  £(-l)fc_1  £  2_Wfl(v'i 

k=  1  <h<m 

m 

Wf( u)  =  2"+1£  X  2^WH(Vi^--ik\-l)k+uvhi2---iksE±i  .  (u)  for  u  =£  0.  □ 

k=  1  l<ii<—<ik<m 


2  Recall  the  notation  for  the  Kronecker  delta  function  <5s(u)  =  1  if  u  e  S,  and  0  otherwise. 
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Next,  we  make  some  observations  on  the  property  of  being  balanced,  for  an  n-variable  monotone  Boolean 
function  of  least  support  set  T  =  {vi, . . . ,  vm}.  For  easy  writing,  we  introduce  the  notation 

Whi2...U  =  wH(vili2...js), 

and  assume  without  loss  of  generality  that  Wi  <  w2  <  ■  ■  ■  <  wm. 

It  is  known  that  a  Boolean  function/  is  balanced  if  and  only  if  W/(0)  =  0.  Thus,  by  the  previous  theorem, 
/  is  a  balanced  monotone  function  of  least  support  T  =  {vi, . . . ,  vm}  if  and  only  if 

m 

£(-l)k_1  ^  =  21. 

k=l  l<ii  <—<ik<m 

When  |T|  =  1  is  straightforward,  every  monotone  function  is  a  singleton,  say  x;,  and  these  are  obviously 
balanced.  If  |T|  =  2,  say  T  =  {vi,  v2}  (of weights  w,-  =  w//(v;),  i  =  1,  2,  and  w12  =  W//(V]2),  assuming,  without 
loss  of  generality,  that  Wi  <  w2)  then  /  is  balanced  if  and  only  if  Wf(0)  =  0,  which  is  equivalent  to 

2~wi  2_w2  _  2_1  2~Wu 


Multiplying  by  2Wu  throughout,  we  get 


2Wi2-Wi  2w12“W2  _  2W12-1  _|_  ^ 

where  0  <  -  Wi  <  w12  -  w2  <  w12  -  1.  By  the  uniqueness  of  binary  representations,  we  get  w12  =  w2 

and  Wi  =  1,  which  contradicts  wi  <  w12  (in  general,  since  the  v*  are  minimal  in  our  partial  order,  it  follows 
that  w,-  <  Wjlii2ii  (j,  for  any  ii  <■■■</<■■■<  is,  s  >  1).  Thus,  there  are  no  balanced  monotone  functions  with 

m  =  2. 

In  general,  if  a  monotone/  with  T  =  {vi, . . . ,  vm}  (m  >  3)  as  its  least  support  is  balanced  then 

£  2_W|i-ik  =  Y  2"Wii-'k  (7.1) 

l<ii<—<ik<m  1<i'i  <-■• <ik<m 

1  <k<m,  odd  0 <k<m,  even 

(by  convention,  =  1  if  7c  =  0). 

One  can  show  easily  that  the  sets  of  exponents  in  the  two  sides  of  (7.1)  cannot  be  the  same.  If  they  were, 
the  smallest  exponent  (in  absolute  value)  in  the  right-hand  side  of  (7.1)  is  Wi,  and  the  smallest  element 
(in  absolute  value)  in  the  left-hand  side  of  (7.1)  is  1,  and  so,  they  must  be  equal,  that  is,  wi  =  1.  Further,  it 
follows  from  (7.1)  that  there  exist  ii  <  ■■■  <  i2s  such  that  w2  =  Since  w2  <  w;j2...y(,  if  2  occurs  among 

the  indices  ;’i  <  ;2  <•••<;’(  (t  >  2),  it  follows  that  none  of  the  indices  ii,  i2, . . . ,  i2s  happens  to  be  2.  Since 
s  >  1,  then  i2  >  2,  and  so  w,-,  ;2...;2l.  >  w,-2  >  w2,  which  is  a  contradiction. 

Remark  7.3.  From  Theorem  7.2  (i)  we  easily  infer  [4,  Theorem  3.6]  where  it  was  shown  that  the  Cayley  graph 
(undirected  graph  having  F"  as  vertices,  and  {u,  v}  as  edges,  where  u  +  v  €  supp (/))  of  an  atomic  monotone 
function  (that  is,  the  least  vector  support  T  has  cardinality  1)  is  singular  (which  is  equivalent  to  the  existence 
of  a  zero  Walsh  coefficient)  if  and  only  if  the  weight  of  /  is  even. 
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